Changeset 96894 in webkit


Ignore:
Timestamp:
Oct 6, 2011 7:48:47 PM (13 years ago)
Author:
fpizlo@apple.com
Message:

DFG should not always speculate that ConvertThis is operating on an object
​https://bugs.webkit.org/show_bug.cgi?id=69570

Reviewed by Oliver Hunt.

Mostly neutral, but with a slight regression in Kraken since it increases
coverage in DFG and thus reveals some performance pathologies (which I
prefer to think of as performance opportunities, in a good way).

  • bytecode/PredictedType.cpp:

(JSC::predictionToString):

  • bytecode/PredictedType.h:

(JSC::isOtherPrediction):
(JSC::mergePredictions):

  • dfg/DFGPropagator.cpp:

(JSC::DFG::Propagator::propagateNodePredictions):

  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

Location:
trunk/Source/JavaScriptCore
Files:
7 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r96889 r96894  
     12011-10-06  Filip Pizlo  <fpizlo@apple.com>
     2
     3        DFG should not always speculate that ConvertThis is operating on an object
     4        https://bugs.webkit.org/show_bug.cgi?id=69570
     5
     6        Reviewed by Oliver Hunt.
     7       
     8        Mostly neutral, but with a slight regression in Kraken since it increases
     9        coverage in DFG and thus reveals some performance pathologies (which I
     10        prefer to think of as performance opportunities, in a good way).
     11
     12        * bytecode/PredictedType.cpp:
     13        (JSC::predictionToString):
     14        * bytecode/PredictedType.h:
     15        (JSC::isOtherPrediction):
     16        (JSC::mergePredictions):
     17        * dfg/DFGPropagator.cpp:
     18        (JSC::DFG::Propagator::propagateNodePredictions):
     19        * dfg/DFGSpeculativeJIT32_64.cpp:
     20        (JSC::DFG::SpeculativeJIT::compile):
     21        * dfg/DFGSpeculativeJIT64.cpp:
     22        (JSC::DFG::SpeculativeJIT::compile):
     23
    1242011-10-06  Mark Hahnenberg  <mhahnenberg@apple.com>
    225

  • trunk/Source/JavaScriptCore/bytecode/PredictedType.cpp

    r95930 r96894  
    4545    BoundsCheckedPointer<char> ptr(description, size);
    4646   
    47     if (value & PredictObjectUnknown) {
    48         ASSERT(!(value & (PredictObjectMask & ~PredictObjectUnknown)));
    49         ptr.strcat("Object");
    50     }
    51 
    5247    if (value & PredictCellOther)
    5348        ptr.strcat("Othercell");

  • trunk/Source/JavaScriptCore/bytecode/PredictedType.h

    r96750 r96894  
    4141static const PredictedType PredictArray         = 0x0002; // It's definitely a JSArray.
    4242static const PredictedType PredictObjectOther   = 0x0010; // It's definitely an object but not JSFinalObject or JSArray.
    43 static const PredictedType PredictObjectUnknown = 0x0020; // It's definitely an object, but we didn't record enough informatin to know more.
    4443static const PredictedType PredictObjectMask    = 0x003f; // Bitmask used for testing for any kind of object prediction.
    4544static const PredictedType PredictString        = 0x0040; // It's definitely a JSString.
    … …  
    108107}
    109108
     109inline bool isOtherPrediction(PredictedType value)
     110{
     111    return value == PredictOther;
     112}
     113
    110114#ifndef NDEBUG
    111115const char* predictionToString(PredictedType value);
    … …  
    114118inline PredictedType mergePredictions(PredictedType left, PredictedType right)
    115119{
    116     if (left & PredictObjectUnknown) {
    117         ASSERT(!(left & (PredictObjectMask & ~PredictObjectUnknown)));
    118         if (right & PredictObjectMask)
    119             return (left & ~PredictObjectUnknown) | right;
    120     } else if (right & PredictObjectUnknown) {
    121         ASSERT(!(right & (PredictObjectMask & ~PredictObjectUnknown)));
    122         if (left & PredictObjectMask)
    123             return (right & ~PredictObjectUnknown) | left;
    124     }
    125120    return left | right;
    126121}

  • trunk/Source/JavaScriptCore/dfg/DFGJITCodeGenerator32_64.cpp

    r96871 r96894  
    376376    }
    377377
    378     GenerationInfo& childInfo = m_generationInfo[at(node.child1())].virtualRegister()];
     378    GenerationInfo& childInfo = m_generationInfo[at(node.child1()).virtualRegister()];
    379379    if (isJSDouble(childInfo.registerFormat())) {
    380380        DoubleOperand op1(this, node.child1());

  • trunk/Source/JavaScriptCore/dfg/DFGPropagator.cpp

    r96567 r96894  
    479479                if (prediction & ~PredictObjectMask) {
    480480                    prediction &= PredictObjectMask;
    481                     prediction = mergePredictions(prediction, PredictObjectUnknown);
     481                    prediction = mergePredictions(prediction, PredictObjectOther);
    482482                }
    483483                changed |= mergePrediction(prediction);

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

    r96871 r96894  
    17111711       
    17121712    case ConvertThis: {
    1713         SpeculateCellOperand thisValue(this, node.child1());
    1714 
    1715         speculationCheck(m_jit.branchPtr(JITCompiler::Equal, JITCompiler::Address(thisValue.gpr()), JITCompiler::TrustedImmPtr(m_jit.globalData()->jsStringVPtr)));
    1716 
    1717         cellResult(thisValue.gpr(), m_compileIndex);
     1713        if (isOtherPrediction(node.prediction())) {
     1714            JSValueOperand thisValue(this, node.child1());
     1715            GPRTemporary scratch(this, thisValue);
     1716           
     1717            GPRReg thisValueTagGPR = thisValue.tagGPR();
     1718            GPRReg scratchGPR = scratch.gpr();
     1719           
     1720            m_jit.move(thisValueTagGPR, scratchGPR);
     1721            m_jit.and32(MacroAssembler::TrustedImm32(JSValue::UndefinedTag), scratchGPR);
     1722            speculationCheck(m_jit.branch32(MacroAssembler::NotEqual, scratchGPR, TrustedImm32(JSValue::UndefinedTag)));
     1723           
     1724            m_jit.move(MacroAssembler::TrustedImmPtr(m_jit.codeBlock()->globalObject()), scratchGPR);
     1725            cellResult(scratchGPR, m_compileIndex);
     1726            break;
     1727        }
     1728       
     1729        if (isObjectPrediction(node.prediction())) {
     1730            SpeculateCellOperand thisValue(this, node.child1());
     1731           
     1732            speculationCheck(m_jit.branchPtr(JITCompiler::Equal, JITCompiler::Address(thisValue.gpr()), JITCompiler::TrustedImmPtr(m_jit.globalData()->jsStringVPtr)));
     1733           
     1734            cellResult(thisValue.gpr(), m_compileIndex);
     1735            break;
     1736        }
     1737       
     1738        JSValueOperand thisValue(this, node.child1());
     1739        GPRReg thisValueTagGPR = thisValue.tagGPR();
     1740        GPRReg thisValuePayloadGPR = thisValue.payloadGPR();
     1741       
     1742        flushRegisters();
     1743       
     1744        GPRResult2 resultTag(this);
     1745        GPRResult resultPayload(this);
     1746        callOperation(operationConvertThis, resultTag.gpr(), resultPayload.gpr(), thisValueTagGPR, thisValuePayloadGPR);
     1747       
     1748        cellResult(resultPayload.gpr(), m_compileIndex);
    17181749        break;
    17191750    }

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

    r96871 r96894  
    17871787       
    17881788    case ConvertThis: {
    1789         SpeculateCellOperand thisValue(this, node.child1());
    1790 
    1791         speculationCheck(m_jit.branchPtr(JITCompiler::Equal, JITCompiler::Address(thisValue.gpr()), JITCompiler::TrustedImmPtr(m_jit.globalData()->jsStringVPtr)));
    1792 
    1793         cellResult(thisValue.gpr(), m_compileIndex);
     1789        if (isOtherPrediction(node.prediction())) {
     1790            JSValueOperand thisValue(this, node.child1());
     1791            GPRTemporary scratch(this, thisValue);
     1792            GPRReg thisValueGPR = thisValue.gpr();
     1793            GPRReg scratchGPR = scratch.gpr();
     1794           
     1795            m_jit.move(thisValueGPR, scratchGPR);
     1796            m_jit.andPtr(MacroAssembler::TrustedImm32(~TagBitUndefined), scratchGPR);
     1797            speculationCheck(m_jit.branchPtr(MacroAssembler::NotEqual, scratchGPR, MacroAssembler::TrustedImmPtr(reinterpret_cast<void*>(ValueNull))));
     1798           
     1799            m_jit.move(MacroAssembler::TrustedImmPtr(m_jit.codeBlock()->globalObject()), scratchGPR);
     1800            cellResult(scratchGPR, m_compileIndex);
     1801            break;
     1802        }
     1803       
     1804        if (isObjectPrediction(node.prediction())) {
     1805            SpeculateCellOperand thisValue(this, node.child1());
     1806           
     1807            speculationCheck(m_jit.branchPtr(JITCompiler::Equal, JITCompiler::Address(thisValue.gpr()), JITCompiler::TrustedImmPtr(m_jit.globalData()->jsStringVPtr)));
     1808           
     1809            cellResult(thisValue.gpr(), m_compileIndex);
     1810            break;
     1811        }
     1812       
     1813        JSValueOperand thisValue(this, node.child1());
     1814        GPRReg thisValueGPR = thisValue.gpr();
     1815       
     1816        flushRegisters();
     1817       
     1818        GPRResult result(this);
     1819        callOperation(operationConvertThis, result.gpr(), thisValueGPR);
     1820       
     1821        cellResult(result.gpr(), m_compileIndex);
    17941822        break;
    17951823    }
Note: See TracChangeset for help on using the changeset viewer.